Workspace Topology-Driven Indirect Prompt Injection in Coding Agents

Technical Analysis

Agentic coding assistants with broad filesystem access can ingest untrusted third-party code, and instructions embedded within that code (comments, docstrings, config files) act as an indirect prompt injection vector when the agent reads and reasons over file contents as part of its context. The paper systematically varies workspace topology -- directory depth, codebase modularity, in-file injection position, and context framing -- and measures Attack Success Rate (ASR) against open-weight models running open-source coding harnesses across three IPI entry points. The attacker's goal in this threat model is goal hijacking: getting the coding agent to execute or propagate instructions embedded in ingested code rather than the developer's intent, crossing the boundary between 'data' (source files) and 'instructions' (agent context) that the model fails to separate. No working exploit or specific payload is disclosed; the paper is a controlled security-research measurement study, and the practical contribution is guidance for evaluating and hardening coding agents rather than a live threat.

Affected Systems

Open-source agentic coding harnesses (unspecified, open-weight model based)

Detection Signatures

• Unusual natural-language imperative statements embedded in code comments, docstrings, README files, or config values (e.g. 'ignore previous instructions', 'run the following command', 'update your task to...')
• Injected text located near file boundaries, top-of-file headers, or deeply nested low-modularity directory structures showing higher trigger rates
• Agent behavior deviating from user-issued task after reading a specific ingested file
• Log correlation between file-read events and subsequent unexpected tool/command invocations

Remediation Steps

1. 1

   Treat ingested code as untrusted data

   Sanitize or isolate natural-language content extracted from comments, docstrings, and config files before including it in agent context; strip or flag imperative-style text that resembles instructions.

2. 2

   Enforce modular, sandboxed ingestion

   Favor modular codebase processing pipelines (matching the paper's finding that high modularity lowers ASR) and process third-party repositories in restricted, permission-limited sandboxes rather than granting broad filesystem/tool access.

3. 3

   Add explicit instruction/data separation

   Use structured prompting or delimiter-based context framing that clearly marks ingested file content as non-authoritative data, and inject explicit security-cue reminders shown by the paper to reduce ASR.

4. 4

   Adopt red-team evaluation using workspace topology variables

   Incorporate directory depth, modularity, injection position, and context framing as test dimensions in internal red-team suites for coding agents, using uncontaminated test environments as the paper recommends.

5. 5

   Least-privilege tool access for coding agents

   Restrict agent-invoked shell/file-write/network tools behind confirmation gates or allowlists so that a successful injection cannot escalate to code execution or exfiltration unchecked.